@@ -149,6 +149,10 @@ jobs:
         working-directory: packages/db
         run: |
           bun -e 'import postgres from "postgres"; const sql = postgres(process.env.DATABASE_URL); for (const extension of ["vector", "btree_gin", "pg_trgm"]) await sql`CREATE EXTENSION IF NOT EXISTS ${sql(extension)}`; await sql.end()'
+          # A test that hangs on a lock leaves only its timeout behind; these name the waiter, the
+          # lock, and the blocking statement in the Postgres log. Service containers take no -c flags,
+          # and ALTER SYSTEM runs outside a transaction, so each setting is its own statement.
+          bun -e 'import postgres from "postgres"; const sql = postgres(process.env.DATABASE_URL); for (const setting of ["log_lock_waits = on", "deadlock_timeout = 1000", "log_min_duration_statement = 20000"]) await sql.unsafe(`ALTER SYSTEM SET ${setting}`); await sql`SELECT pg_reload_conf()`; await sql.end()'
           bun run db:${{ matrix.provision }}
 
       - name: Verify migration replay is a no-op
 
@@ -268,6 +268,7 @@ jobs:
       DOCS_GENERATORS_REPORT_PATH: ${{ github.workspace }}/apps/docs/test-results/generators/report.json
       DOCS_COMPATIBILITY_REPORT_PATH: ${{ github.workspace }}/apps/docs/test-results/compatibility.json
       DOCS_HEADER_REPORT_PATH: ${{ github.workspace }}/apps/docs/test-results/docs-headers.json
+      GITLAB_EXPORT_REPORT_PATH: ${{ github.workspace }}/apps/docs/test-results/gitlab-export.json
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
@@ -292,6 +293,8 @@ jobs:
       - name: Verify native header edge cases
         if: ${{ !cancelled() && steps.generators.outcome != 'skipped' }}
         run: bun run --cwd apps/docs test:headers:e2e
+      - name: Verify GitLab CSV export over HTTPS
+        run: python3 apps/docs/scripts/test-gitlab-export-e2e.py
       - name: Bound the generated content cache
         if: always()
         run: bash .github/actions/docs-content-cache/prune.sh content
 
@@ -234,11 +234,10 @@ Cadence: Electron ships a major every ~8 weeks and supports the latest 3 — bud
 
 ## Native Mac computer use
 
-Mothership's `computer` tool is available on macOS 14+ when the global runtime flag
-`mothership-computer-use` is enabled and the user opts in under **Settings → Desktop → Computer Use**.
-The flag defaults off; local/self-hosted deployments use `MSHIP_COMPUTER_USE=true`, while hosted
-rollout uses the existing AppConfig feature-flags document. Older desktop builds omit this optional
-bridge and continue to work.
+Mothership's `computer` tool is available on macOS 14+ once the user opts in under
+**Settings → Desktop → Computer Use**. Enterprise organizations can withhold it from a permission
+group with the **Computer Use** restriction. Older desktop builds omit this optional bridge and
+continue to work.
 
 The user grants Accessibility and Screen Recording through macOS, then approves each app for the
 current task or persistently. Persistent app approvals are listed in Settings and can be revoked.
 
@@ -1365,7 +1365,7 @@ test.describe('browser tools', () => {
     expect(await formState()).toMatchObject({ name: 'Observed value' })
     const result = fill.result as { observation: { result: { matches: { elementId: number }[] } } }
     const freshId = result.observation.result.matches[0].elementId
-    expect(freshId).not.toBe(ref('Name'))
+    expect(freshId).toBe(ref('Name'))
     const clear = await execute('browser_type', { elementId: freshId, text: '', observe: {} })
     expect(clear.ok, clear.error).toBe(true)
     expect(clear.result).toMatchObject({ observation: { ok: true } })
 
@@ -60,6 +60,7 @@ test('native file tools remember folder consent across chats and restarts until
       stdin: {
         contents: `import { createRoot } from 'react-dom/client';
 import { ToastProvider } from '@sim/emcn';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { AppRouterContext } from 'next/dist/shared/lib/app-router-context.shared-runtime';
 import { PathParamsContext } from 'next/dist/shared/lib/hooks-client-context.shared-runtime';
 import { Desktop } from '@/app/workspace/[workspaceId]/settings/components/desktop/desktop';
@@ -70,11 +71,11 @@ const router = { bfcacheId: 'fixture', back: () => history.back(), forward: () =
 createRoot(document.getElementById('settings')).render(
   <AppRouterContext.Provider value={router}>
     <PathParamsContext.Provider value={{ workspaceId: 'fixture' }}>
-      <ToastProvider><SettingsHeaderProvider><SettingsHeaderShell>
+      <QueryClientProvider client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}><ToastProvider><SettingsHeaderProvider><SettingsHeaderShell>
         <FeatureFlagsProvider flags={{ dashboards: false, 'workflow-tests': false, 'mothership-model-selector': false, 'mothership-plan-mode': false }}>
           <SettingsSectionProvider plane='workspace' section='desktop'><Desktop /></SettingsSectionProvider>
         </FeatureFlagsProvider>
-      </SettingsHeaderShell></SettingsHeaderProvider></ToastProvider>
+      </SettingsHeaderShell></SettingsHeaderProvider></ToastProvider></QueryClientProvider>
     </PathParamsContext.Provider>
   </AppRouterContext.Provider>
 );`,
 
@@ -1507,13 +1507,13 @@ describe('browserToolWatchdogMs', () => {
   })
 
   it.each([
-    ['number', 30_000, 35_000],
-    ['numeric string', '30000', 35_000],
-    ['absent', undefined, 15_000],
-    ['non-numeric', 'soon', 15_000],
-    ['zero', 0, 15_000],
-    ['negative', -5_000, 15_000],
-    ['above the wait clamp', 500_000, 125_000],
+    ['number', 30_000, 55_000],
+    ['numeric string', '30000', 55_000],
+    ['absent', undefined, 35_000],
+    ['non-numeric', 'soon', 35_000],
+    ['zero', 0, 35_000],
+    ['negative', -5_000, 35_000],
+    ['above the wait clamp', 500_000, 145_000],
   ])('normalizes browser_wait_for timeout (%s)', (_label, timeoutMs, expected) => {
     const params = timeoutMs === undefined ? {} : { timeoutMs }
 
@@ -3098,40 +3098,180 @@ describe('credential protection', () => {
     })
   })
 
+  it('gives a wait that runs to its timeout a full snapshot budget for its closing observation', async () => {
+    const contents = await openPage()
+    let finishSnapshot: (value: unknown) => void = () => {}
+    vi.mocked(contents.executeJavaScript).mockImplementation((expression: string) => {
+      if (!isPageCall(expression, 'collectSnapshot')) return Promise.resolve(undefined)
+      return new Promise((resolve) => {
+        finishSnapshot = resolve
+      })
+    })
+    vi.useFakeTimers()
+    try {
+      const waiting = driver.executeTool('chat-test', 'browser_wait_for', { timeoutMs: 1_000 })
+      await vi.advanceTimersByTimeAsync(9_000)
+      finishSnapshot({
+        url: 'https://example.com/',
+        title: 'Example',
+        outline: '- heading "Order confirmed"',
+        truncated: false,
+        refIds: [],
+        refLineIndexes: {},
+        nextElementId: 1_000,
+      })
+      await vi.advanceTimersByTimeAsync(1_000)
+
+      expect(await waiting).toMatchObject({
+        ok: true,
+        result: { observation: { ok: true, result: { outline: '- heading "Order confirmed"' } } },
+      })
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('accepts a later snapshot that keeps refs this scope issued for the same page', async () => {
+    const contents = await openPage()
+    const snapshot = (refIds: number[], nextElementId: number) => ({
+      url: 'https://example.com/',
+      title: 'Example',
+      outline: refIds.map((ref) => `- button "B${ref}" [ref=${ref}]`).join('\n'),
+      truncated: false,
+      refIds,
+      refLineIndexes: Object.fromEntries(refIds.map((ref, index) => [ref, index])),
+      nextElementId,
+    })
+    respondWith(contents, { collectSnapshot: snapshot([4, 5], 6) })
+    await driver.executeTool('chat-test', 'browser_snapshot', {})
+    respondWith(contents, { collectSnapshot: snapshot([4, 6], 7) })
+
+    const kept = await driver.executeTool('chat-test', 'browser_snapshot', {})
+    expect(kept).toMatchObject({ ok: true })
+    respondWith(contents, { collectSnapshot: snapshot([2], 7) })
+
+    const forged = await driver.executeTool('chat-test', 'browser_snapshot', {})
+    expect(forged).toMatchObject({ ok: false })
+  })
+
+  it("forgets a page's oldest refs once its history passes the retention bound", async () => {
+    const contents = await openPage()
+    const snapshot = (refIds: number[], nextElementId: number) => ({
+      url: 'https://example.com/',
+      title: 'Example',
+      outline: refIds.map((ref) => `- button "B${ref}" [ref=${ref}]`).join('\n'),
+      truncated: false,
+      refIds,
+      refLineIndexes: Object.fromEntries(refIds.map((ref, index) => [ref, index])),
+      nextElementId,
+    })
+    let next = 0
+    for (let round = 0; round < 19; round++) {
+      const refIds = Array.from({ length: 300 }, (_, index) => next + index)
+      next += 300
+      respondWith(contents, { collectSnapshot: snapshot(refIds, next) })
+      expect(await driver.executeTool('chat-test', 'browser_snapshot', {})).toMatchObject({
+        ok: true,
+      })
+    }
+    respondWith(contents, { collectSnapshot: snapshot([next - 1], next) })
+    expect(await driver.executeTool('chat-test', 'browser_snapshot', {})).toMatchObject({
+      ok: true,
+    })
+    respondWith(contents, { collectSnapshot: snapshot([0], next) })
+
+    expect(await driver.executeTool('chat-test', 'browser_snapshot', {})).toMatchObject({
+      ok: false,
+    })
+  })
+
+  it('recaptures with fresh ids when the page reuses an id this scope never committed', async () => {
+    const contents = await openPage()
+    const snapshot = (refIds: number[], nextElementId: number) => ({
+      url: 'https://example.com/',
+      title: 'Example',
+      outline: refIds.map((ref) => `- button "B${ref}" [ref=${ref}]`).join('\n'),
+      truncated: false,
+      refIds,
+      refLineIndexes: Object.fromEntries(refIds.map((ref, index) => [ref, index])),
+      nextElementId,
+    })
+    respondWith(contents, { collectSnapshot: snapshot([4, 5], 6) })
+    await driver.executeTool('chat-test', 'browser_snapshot', {})
+    vi.mocked(contents.executeJavaScript).mockImplementation((expression: string) => {
+      if (!isPageCall(expression, 'collectSnapshot')) return Promise.resolve(undefined)
+      const forgets = expression.includes(',true])')
+      return Promise.resolve(forgets ? snapshot([6, 7], 8) : snapshot([2, 6], 7))
+    })
+
+    const result = await driver.executeTool('chat-test', 'browser_snapshot', {})
+
+    expect(result).toMatchObject({
+      ok: true,
+      result: { outline: expect.stringContaining('[ref=7]') },
+    })
+  })
+
+  it('acts on a ref an earlier snapshot of the same page issued', async () => {
+    const contents = await openPage()
+    respondWith(contents, {
+      collectSnapshot: {
+        url: 'https://example.com/',
+        title: 'Example',
+        outline: '- button "Pins" [ref=4]\n- button "Files" [ref=5]',
+        truncated: false,
+        refIds: [4, 5],
+        refLineIndexes: { 4: 0, 5: 1 },
+        nextElementId: 6,
+      },
+    })
+    await driver.executeTool('chat-test', 'browser_snapshot', {})
+    respondWith(contents, {
+      collectSnapshot: {
+        url: 'https://example.com/',
+        title: 'Example',
+        outline: '- dialog "Pick a time" [ref=6]',
+        truncated: false,
+        refIds: [6],
+        refLineIndexes: { 6: 0 },
+        nextElementId: 7,
+      },
+    })
+    await driver.executeTool('chat-test', 'browser_find', { query: 'time' })
+
+    const clicked = await driver.executeTool('chat-test', 'browser_click', { elementId: 4 })
+    expect(clicked).toMatchObject({ ok: true, result: { dispatched: true } })
+  })
+
   it.each([
     ['browser_snapshot', 'true'],
     ['browser_find', 'false'],
-  ] as const)(
-    'passes the current root ref to %s and invalidates previous refs',
-    async (tool, markNew) => {
-      const contents = await openPage()
-      respondWith(contents, {
-        collectSnapshot: {
-          url: 'https://example.com/login',
-          title: 'Scoped',
-          scoped: true,
-          outline: '- button "Save" [ref=1]',
-          truncated: false,
-          refIds: [1],
-          refLineIndexes: { 1: 0 },
-          nextElementId: 2,
-        },
-      })
-      const result = await driver.executeTool('chat-test', tool, { elementId: 0, query: 'Save' })
-      expect(result).toMatchObject({ ok: true, result: { scoped: true } })
-      expect(
-        vi
-          .mocked(contents.executeJavaScript)
-          .mock.calls.some(
-            ([expression]) =>
-              isPageCall(expression, 'collectSnapshot') &&
-              expression.includes(`.apply(null, [1,0,${markNew}])`)
-          )
-      ).toBe(true)
-      const stale = await driver.executeTool('chat-test', 'browser_click', { elementId: 0 })
-      expect(stale).toMatchObject({ ok: false })
-    }
-  )
+  ] as const)('passes the current root ref to %s', async (tool, markNew) => {
+    const contents = await openPage()
+    respondWith(contents, {
+      collectSnapshot: {
+        url: 'https://example.com/login',
+        title: 'Scoped',
+        scoped: true,
+        outline: '- button "Save" [ref=1]',
+        truncated: false,
+        refIds: [1],
+        refLineIndexes: { 1: 0 },
+        nextElementId: 2,
+      },
+    })
+    const result = await driver.executeTool('chat-test', tool, { elementId: 0, query: 'Save' })
+    expect(result).toMatchObject({ ok: true, result: { scoped: true } })
+    expect(
+      vi
+        .mocked(contents.executeJavaScript)
+        .mock.calls.some(
+          ([expression]) =>
+            isPageCall(expression, 'collectSnapshot') &&
+            expression.includes(`.apply(null, [1,0,${markNew},`)
+        )
+    ).toBe(true)
+  })
 
   it.each([
     { kind: 'input:checkbox', checked: true, disabled: false, readOnly: false },